rsync 3.5.0 has arrived, delivering fixes for 33 CVEs across symlink race conditions, daemon protocol flaws, and authentication bypasses. The release introduces secure_relative_open(), a hardened path-resolution framework that pins directory file descriptors and blocks out-of-tree symlink hops. If you run rsync with elevated privileges or rely on it for CI/CD and cloud backups, updating immediately is non-negotiable. Backports for the 3.4.1 and 3.2.7 branches are rolling out alongside the main release this week.

rsync 3.5.0 Drops with 33 CVEs Fixed, Plugging Symlink Race Conditions That Haunt Backup Pipelines

rsync 3.5.0 is here, and it is fixing 33 CVEs. Andrew Tridgell announced the release on the rsync-announce mailing list on August 13, 2026. The update targets symlink race conditions that have been a persistent headache for anyone running rsync with elevated privileges. If you are running backup jobs as root and a less-privileged user can write to the source tree, this release is non-negotiable.

rsync is the duct tape holding your infrastructure together. It ships on every Linux distro, macOS, BSDs, and Windows via Cygwin. It runs in your CI/CD pipelines, your cloud infrastructure, and probably your personal backup scripts. The sheer volume of deployments makes every vulnerability a potential catastrophe.

The Symlink Race Is the Real Story

The headline grabber here is the symlink race condition. Roughly 15 of the 33 CVEs address TOCTOU bugs where an attacker plants symlinks to redirect rsync operations outside the intended destination.

CVE-2026-53802 lets attacker-planted symlinks in filter files leak arbitrary file contents. CVE-2026-53803 allows symlinked output paths to redirect writes, potentially appending to authorized_keys for SSH persistence. That is a classic lateral movement primitive. CVE-2026-53785 shows directory creation bypassing confinement via parent symlink races under --relative.

If rsync runs with elevated privileges, a planted symlink can turn a routine backup into a privilege escalation event. The impact assessment calls the overall risk critical.

A New Defense-in-Depth Architecture

The fix is a comprehensive framework called secure_relative_open(). It walks directories per-component using O_NOFOLLOW to pin directory file descriptors. Once a parent directory is resolved, every subsequent operation runs through an *at() call. Because the descriptor is bound to the directory inode, a parent component flipped to a symlink mid-operation cannot redirect anything.

On Linux 5.6+, the resolver also uses openat2(RESOLVE_BENEATH) for kernel-level confinement. This blocks .., absolute symlinks, and out-of-tree hops. If you are on a modern Linux system, every issue described in the security policy is fully addressed.

The policy states clearly: On a modern Linux system every issue described in this document is fully addressed. Remotely reachable defects are fixed unconditionally on all platforms. Only local-attacker residual races on non-Linux platforms are accepted as documented out-of-scope.

Daemon Protocol and DoS Fixes

Other CVEs target the daemon protocol. CVE-2026-70461 fixes a one-byte heap out-of-bounds write via crafted peer-supplied filter rules. CVE-2026-70456 addresses a heap buffer overflow in read_args() at boundary conditions. There is also a critical CVE for proxy protocol spoofing that allows source-address spoofing if proxy protocol = true is set without trusted-proxy configuration. That one deserves a double-take if you rely on host-based ACLs.

The hash_search DoS bug tracked as issue #217 since 2021 finally got a proper fix in CVE-2026-70453. It is satisfying to see a publicly tracked issue from five years ago close out cleanly. The quadratic CPU exhaustion could be triggered by crafted equal weak-checksum chains. Issue #217 was reported by heyciao back in 2021, and the delay in a robust fix speaks to the longevity of the vulnerability.

Backports and Platform Quirks

Backports are available for rsync 3.4.1 and 3.2.7. Distro updates for LTS distributions were expected within days of the announcement. If your distro has not published the update yet, you can build from source or use the provided diff against 3.4.4 for backporting.

Keep in mind that non-Linux platforms have residual risks. BSDs, macOS pre-15, and Cygwin accept path-based fallbacks for metadata application. If you are on one of these platforms, consider restricting module write access with munge symlinks = yes. The security document provides a thorough accounting of platform-specific limitations, so review it if you are running rsync outside a modern Linux environment.

What to Do Now

Update immediately to rsync 3.5.0 if you are running any version prior to this release. Verify your distribution has published the update. Review rsyncd.conf settings, particularly proxy protocol, auth users parsing, and any modules using use chroot = no.

The download page has the source tarball, diff files, and GPG signatures. Head here to grab rsync 3.5.0.

It is a rather exhaustive release for the internal architecture it is reshaping, though the symlink hardening does justify the attention. The scale of the fix suggests rsync has been a high-value target for a long time. Updating now is the right move.